Method: projects.locations.collections.engines.checkFeaturePolicyMembers

Checks members for Engine.feature_policies against the project's directory, as EngineService.UpdateEngine does when it saves them, and saves nothing.

HTTP request


POST https://discoveryengine.googleapis.com/v1alpha/{name=projects/*/locations/*/collections/*/engines/*}:checkFeaturePolicyMembers

The URLs use gRPC Transcoding syntax.

Path parameters

Parameters
name

string

Required. The engine resource name. Format: projects/{project}/locations/{location}/collections/{collection}/engines/{engine}

Request body

The request body contains data with the following structure:

JSON representation 
{
  "members": [
    {
      object (Member)
    }
  ]
}
Fields
members[]

object (Member)

Required. The members to check, in the form a policy takes them. At least 1 and at most 100. verification is ignored.

Response body

Response for EngineService.CheckFeaturePolicyMembers method.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "directorySource": enum (DirectorySource),
  "memberChecks": [
    {
      object (MemberCheck)
    }
  ]
}
Fields
directorySource

enum (DirectorySource)

Where the project's groups are looked up.
memberChecks[]

object (MemberCheck)

One result per requested member, in request order. Members are checked independently, so two emails for the same Google group both pass.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/discoveryengine.readwrite
  • https://www.googleapis.com/auth/discoveryengine.serving.readwrite

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the name resource:

  • discoveryengine.engines.update

For more information, see the IAM documentation.

DirectorySource

Where the project's groups are looked up. Computed from the project's identity setup on each request.

Enums
DIRECTORY_SOURCE_UNSPECIFIED The source couldn't be determined; every group is CHECK_FAILED.
GOOGLE Google identity (Workspace or Cloud Identity). Groups are emails.
SCIM Workforce Identity Federation with SCIM groups in the project's workforce pool.
NONE Workforce Identity Federation without SCIM groups: no directory to check against.

MemberCheck

The result for one requested member.

JSON representation 
{
  "member": {
    object (Member)
  },
  "status": {
    object (Status)
  }
}
Fields
member

object (Member)

The member as EngineService.UpdateEngine would save it: id normalized, displayName taken from the directory when it has one, and verification set. Echoes the request's member when status is an INVALID_ARGUMENT from the member's format.
status

object (Status)

OK when the member is valid and, for a group, in the directory. Otherwise INVALID_ARGUMENT for a malformed member or a group the directory doesn't have, and UNAVAILABLE for a Google group the directory couldn't be asked about. EngineService.UpdateEngine fails on all of these, except that it leaves out an allowed group the directory doesn't have, saves the other members, and lists the group in Engine.feature_policy_rejections.